Unauthorized Call Activity Detection And Prevention Systems And Methods For A Voice Over Internet Protocol Environment

ABSTRACT

Embodiments connect a call in which at least one party is a VoIP call party and monitoring resulting VoIP signals for unauthorized call activity, such as three-way call activity. The monitoring may include monitoring the call for suspend and/or resume events to detect the unauthorized call activity, the suspend and resume events may be generated by a telephone system and passed into a VoIP system associated with the VoIP call party. The monitoring may be carried out by an agent disposed between a VoIP gateway and the VoIP call party or by the VoIP gateway itself.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application is a continuation of, and claims priority to,U.S. patent application Ser. No. 11/403,547, filed on Apr. 13, 2006,entitled “UNAUTHORIZED CALL ACTIVITY DETECTION AND PREVENTION SYSTEMSAND METHODS FOR A VOICE OVER INTERNET PROTOCOL ENVIRONMENT,” which isincorporated by reference herein in its entirety. The presentapplication is also related to U.S. patent application Ser. No.10/646,638, filed Aug. 22, 2003, entitled “SYSTEM AND METHOD FOR CALLREDIRECT DETECTION AND TREATMENT,” now issued as U.S. Pat. No.7,372,949; U.S. patent application Ser. No. 10/252,956, filed on Sep.20, 2002, entitled “THREE-WAY TELEPHONE CALL PREVENTION SYSTEM ANDMETHOD,” now issued as U.S. Pat. No. 7,079,636; a co-pending U.S. patentapplication Ser. No. 10/642,532, filed on Aug. 15, 2003, entitled“CENTRALIZED CALL PROCESSING”; a co-pending U.S. patent application Ser.No. 10/800,473 filed Mar. 15, 2004, entitled “CALL PROCESSING WITH VOICEOVER INTERNET PROTOCOL TRANSMISSION”; and U.S. patent application Ser.No. 09/905,014 filed Jul. 13, 2001, entitled “PUBLIC TELEPHONE CONTROLWITH VOICE OVER INTERNET PROTOCOL TRANSMISSION,” now issued as U.S. Pat.No. 7,505,406, which are incorporated by reference herein in theirentirety.

TECHNICAL FIELD

The present invention relates to the field of telecommunications and inparticular to systems and methods for detecting and/or preventing theunauthorized use of call features in a Voice over Internet Protocol(VoIP) environment.

BACKGROUND OF THE INVENTION

Private premise-based telephone systems, such as those installed atcorrectional facilities or other controlled-environment facilities, havecreated a need to monitor various events occurring on the telephonelines of the system. Telephone systems at correctional facilities orother controlled-environment facilities may comprise amicroprocessor-based call processing system having operational softwarethat is capable of allowing control over telephones connected to thesystem. For example, the system may be programmed to prevent inmates orresidents from contacting unauthorized parties or using the telephonesystem for fraudulent purposes. An authorization mechanism may beutilized to prevent residents from dialing unauthorized numbersdirectly.

Additionally, a call processing system my prevent a resident frominitiating a three-way call, taking part in a conference call, or thelike. However, a particular problem that is encountered in these systemsis the placement of a three-way call, or the like, by a party that isauthorized to be called by the resident. Once the resident is connectedto an authorized number, the resident may be connected to a third partyat an unauthorized number via the three-way call feature by a party atthe authorized number. Care may be taken to insure that a resident doesnot call an unauthorized party. However, once a call is connectedthrough the Public Switched Telephone Network (PSTN) it becomes verydifficult to control the actions of the called party. Therefore, topreserve this screening activity, it is desirable to insure that thecalled party is in fact the person to whom the call is terminating.Therefore, it is desirable to have control of the call with respect toall the parties who are on the phone call. In short, it is desirable toprevent addition of an unknown third party to a resident call in orderto preserve the integrity of the initial call screening

A three-way call may be initiated when the originally called party (e.g.an authorized party outside the private telephone system) depresses thehook switch on the telephone, generating a hook flash signal. Thissignals the telephone central office to put the resident on hold andprovide a dial tone to the originally called party. On receipt of thedial tone, the originally-called party dials the number of anunauthorized third party, and when the connection is completed, theresident and the unauthorized third party can communicate through theconnection established outside the private system.

Three-way call monitoring systems which have been developed to preventunauthorized calls according to the foregoing scenario rely on thedetection of telephone signals. They typically monitor the localtelephone connection for the hook flash “click” signal or associatedcentral office signals that fall in a frequency band outside the rangeof frequencies produced by the human voice. These systems typicallymonitor signals on the local telephone line through a frequency filterdesigned to pass audio signals in this frequency band. A three-way callattempt may be indicated whenever signals in the frequency band haveenergies above a selected threshold. Some systems compare the signalswith a hook flash reference signal utilizing sampling techniquesimplemented with a digital signal processor (DSP).

Even in a more or less conventional telephone environment these systemsmay not be very accurate for a number of reasons. The underlyingassumptions about the frequency profile of three-way call events, i.e.the hook flash and signals generated by activating central officeswitches, are often wrong. For example, the hook flash signals are oftenmodified by transmission through switches and along loaded lines, andeven if assumptions about the frequency characteristics of the initialsignal are accurate, these characteristics may be substantiallydistorted by the time the “hook flash” signal reaches a call processingsystem implementing three-way call detection, or the like.

Other systems and methods for detecting undesired call activity aredisclosed in Salibrici, U.S. Pat. No. 5,768,355 and above-incorporatedcommonly owned, co-pending U.S. patent application Ser. No. 10/252,956,filed Sep. 20, 2002 and entitled THREE-WAY TELEPHONE CALL PREVENTIONSYSTEM AND METHOD. Salibrici teaches using digital signal processing toidentify a third-party connection. Salibrici operates by establishing abaseline ambient, or background, noise level, and detecting when thesignal noise level drops below the ambient noise level. When the currentsignal noise level drops below the ambient noise level, the systemassumes that a three-way conference call has been attempted by thecalled party. U.S. patent application Ser. No. 10/252,956 discloses anexemplary technique for detecting three-way calls, which in generalincludes detecting a call signal level, determining if the call signallevel is below a predetermined silence level threshold, and measuring aduration the call signal level remains below the predetermined silencelevel threshold.

Internet protocol (“IP”) is a routing protocol designed to route trafficwithin a network or between networks. VoIP is a method for providingvoice capabilities over an IP network, such as the Internet or anintranet. In such networks data packets are sent to and fromcommunication sites to facilitate communication. In communicationsystems utilizing a VoIP protocol, the packets are commonly referred toas datagrams. In typical VoIP networks, each communication site sendsdatagrams to other communication sites with which they are incommunication. There are different approaches to sending datagrams.Control signals per ITU recommendation H.323, and audio-based mediastreams using Real-Time Transport Protocol (RTP) per Internet RFC 1889,may be applied. Alternatively, control signals could be applied usingother protocols such as Session Initiation Protocol (SIP) per InternetRFC 2543.

SUMMARY

Embodiments of the present invention are directed generally to systemsand methods for detecting and/or preventing unauthorized call activityin a VoIP environment. According to certain embodiments, a call isconnected in which at least one party is a VoIP call party, andresulting VoIP signals for the call are monitored for detectingunauthorized call activity. In a first situation wherein a call is aninterconnection between a PSTN-based call and a VoIP call, such as aSIP-based or RTP-based call, different methods for detection of VoIPsignals that indicate or include suspend and resume events may be usedto detect unauthorized call activity, such as initiation of a three-waycall. For example, when the user on a PSTN line attempts to activate atraditional form of three-way calling, or undertakes similarunauthorized call activity, embodiments of the present invention detectvarious VoIP signals from which the three-way call attempt may bedetermined. As used herein, the phrase “VoIP signals” may refer tovarious out-of-band and/or in-band signaling, either of which may be apart of VoIP data packets or may be separate VoIP-related instructions.Appropriate action may then be taken by calling systems employing anembodiment of the present invention upon detection of unauthorized callactivity, such as intervening in the call to warn the parties to notparticipate in a three-way call (e.g., via an interactive voice responseunit or the like), disconnecting the call, monitoring the call forinvestigative purposes, and/or the like. As an example of use of in-bandsignals for three-way call detection, the return of Voice ActivationDetection (VAD) idle noise is used by an embodiment of the presentinvention, where VAD idle noise being received may be treated as asilence period and used as an indicator of initiation of a three-waycall. Examples of out-of-band signaling that might be used to detectunauthorized call activity might include Signaling System 7 (SS7)signaling, or the like.

In situations wherein both parties to a call are employing VoIP,signaling that occurs between traditional VoIP devices may be monitoredto determine when one VoIP device invites another party or anothergateway to join into the existing VoIP call. Again, a call processingsystem employing an embodiment of the present invention may takeappropriate action in response to detection of an attempt to initiate athree-way call. Alternatively, in a VoIP-only environment, the additionof third parties to a call may be disallowed at the time the call isestablished to avoid the need to later detect attempts to initiatethree-way calling.

Certain embodiments of the present invention also employ an ability tomonitor a call for cadence, frequency, amplitude, phonetics, tonalcombinations, and/or other attributes that occur in speech, and to usesuch information to determine the number of voices taking part in acall. Thus, in accordance with an embodiment of the present invention,the addition of a unique set of voice variables may show that a thirdparty has joined a call. Again, a system employing an embodiment of thepresent invention may take appropriate action such as intervening towarn the parties to not participate in a three-way call, disconnectingthe call, monitoring the call for investigative purposes or the like. Anability to monitor a call may be used to monitor for and identify othersounds of interest (e.g., from background sounds of one or more partieson the call), such as that of a gunshot, a scream, outdoor sounds(birds, wind noise, etc.), DTMF, recording tones, alarms, sirens,etcetera. An investigator may be alerted as a result of the detection ofthe sound of the call flagged for investigation.

Embodiments of the present invention have particularly advantageousapplicability within controlled-environment facilities. Examples ofcontrolled-environment facilities include correctional facilities (e.g.,municipal jails, county jails, state prisons, federal prisons, militarystockades, juvenile facilities, and detention camps), healthcarefacilities (e.g., hospitals, nursing homes, mental health facilities,and rehabilitation facilities, such as drug and alcohol rehabilitationfacilities), restricted living quarters (e.g., hotels, resorts, camps,dormitories, and barracks), and the like. Certain controlled-environmentfacilities may be thought of as a small community or city, perhapswalled or otherwise access restricted, wherein various activities occurwithin the community and between the community and those outside thecommunity in the daily operation thereof. Such a community includes anumber of individuals and enterprises directly associated therewith,including management, staff, and inmates, residents, patients, or guests(herein referred to as “residents”), and a number of individuals andenterprises indirectly associated therewith, including friends andfamily of residents, vendors, government agencies, providers of servicesto residents, and individuals with a connection to the facility or itsresidents. As described further herein, embodiments of the presentinvention have particular applicability within correctional facilities,but the concepts described herein may likewise be employed in othercontrolled-environment facilities.

Certain embodiments of the present invention make use of data concerninga resident of a controlled-environment facility that is placing a call,and/or data related to a called party or number, to determine if thereis a propensity for a three-way call situation to arise in a call placedby the resident of the facility. This information may be provided by acontrolled-environment facility's call management system, acontrolled-environment facility's information management system, or thelike associated with a controlled-environment facility in which theresident resides.

As a result of a determination that an elevated propensity for athree-way calling situation exists, sensitivity of three-way calldetection methods and/or systems, such as discussed above and/ordisclosed in the incorporated references, may be elevated for a callplaced by that resident and/or a call placed to a party or number.Alternatively or additionally, if a call has a heightened propensity fora three-way call situation to arise, the response applied by a systememploying an embodiment of the present invention may be elevated. Forexample, if a three-way call attempt would normally only be logged orotherwise noted for possible further investigation, the parties to thecall may be warned, and in a situation where the call's parties mightnormally only be warned, a call may be disconnected when an attempt toinitiate a three-way call is detected.

The foregoing has outlined rather broadly the features and technicaladvantages of the present invention in order that the detaileddescription of the invention that follows may be better understood.Additional features and advantages of the invention will be describedhereinafter which form the subject of the claims of the invention. Itshould be appreciated by those skilled in the art that the conceptionand specific embodiment disclosed may be readily utilized as a basis formodifying or designing other structures for carrying out the samepurposes of the present invention. It should also be realized by thoseskilled in the art that such equivalent constructions do not depart fromthe spirit and scope of the invention as set forth in the appendedclaims. The novel features which are believed to be characteristic ofthe invention, both as to its organization and method of operation,together with further objects and advantages will be better understoodfrom the following description when considered in connection with theaccompanying figures. It is to be expressly understood, however, thateach of the figures is provided for the purpose of illustration anddescription only and is not intended as a definition of the limits ofthe present invention.

BRIEF DESCRIPTION OF THE DRAWINGS

For a more complete understanding of the present invention, reference isnow made to the following descriptions taken in conjunction with theaccompanying drawing, in which:

FIG. 1 is a block diagram of a telephone system adapted in accordancewith an exemplary embodiment of the present invention;

FIG. 2 is a flowchart of unauthorized call activity detection accordingto an embodiment of the present invention; and

FIG. 3 is a flowchart of unauthorized call activity detection accordingto another embodiment of the present invention.

DETAILED DESCRIPTION

In a VoIP environment, particular problems arise for detecting three-waycalls. Triggers that might normally be used to detect initiation of athree-way call in a conventional PSTN environment, or the like, may notbe passed in a VoIP-based call. For example, in a packetized VoIPenvironment it is very difficult to detect a hook flash or silence.Packets oftentimes will not pass a hook flash, or similar sound, or passsilence. Similarly, lower so-called “levels of silence” are typicallyscreened out of packets during the creation of the packets.

As for “level of silence” or similar triggers that may be used inthree-way call detection within a VoIP environment, typically when sounddrops below some threshold level it is deemed to be silence and nottransmitted. VoIP data transmission bandwidth usage may be minimizedthrough the use of Voice Activation Detection (VAD), or other methods.VAD allows a data network carrying voice traffic over the Internet todetect the absence of audio and conserve bandwidth by preventing thetransmission of “silent packets” over the network. Most conversationsinclude about 50% silence. VAD (also called “silence suppression”) canbe enabled to monitor signals for voice activity so that when silence isdetected for a specified amount of time, the application informs thePacket Voice Protocol and prevents the encoder output from beingtransported across the network. VAD may also be used to forward idlenoise characteristics (sometimes called ambient or comfort noise) to aremote IP telephone or gateway. A standard for digitized voice, 64 Kbps,is a constant bit rate whether the speaker is actively speaking, ispausing between thoughts, or is totally silent. Without idle noisegiving the illusion of a constant transmission stream during silencesuppression, the listener would be likely to think the line had gonedead. As a result, sounds at different levels of silence are not passedin a VoIP call. Therefore, since conventional three-way call detectionmay analyze different “thresholds of silence” to determine whether ornot a caller is “away” setting up a three-way call, conventionalthree-way call detection in VoIP calls is problematic.

As for a hook flash or similar triggers, a sharp click occurs when aswitch hook is depressed. This click is usually proceeded by a period ofsilence, and since a VoIP system would not necessarily be transmittingencoded sound packets during the silence period, the sharp click istypically the first sound that starts the VoIP system transmittingencoded sound packets again. However, a VoIP system will not typicallyreact fast enough to catch the click, and therefore the VoIP system maynot transmit the click at all or truncate the click rendering itunrecognizable by a conventional three-way call detection system. Forexample, a rising edge of the click may trigger a VoIP filter to startpassing packets again, yet not transmit the click itself. Morespecifically, VoIP systems may have jittering timing and as a result ahook flash click may be completely screened out in the VoIPtransmission, similar to the “levels of silence” discussed above,together making both silence detection and/or click detectionproblematic for use in three-way call detection in a VoIP environment.Therefore, use of VoIP creates new issues in regards to detecting and/orpreventing three-way call activity.

FIG. 1 shows telephone communication system 100, adapted in accordancewith an exemplary embodiment of the present invention. Telephonecommunication system 100 of the embodiment illustrated in FIG. 1includes a plurality of telephone terminals 110-113 disposed at alocation for which calling services are to be provided. The locationmay, for example, comprise a prison or other controlled-environmentfacility in which the use of telephones 110-113 is monitored andcontrolled.

In order to better aid the reader in understanding the concepts of thepresent invention, telephone communications systems and methods of thepresent invention are described herein with reference to configurationand use in providing calling services to a correctional facility, suchas a jail, a prison or a similar controlled-environment facility.However, it should be appreciated that call processing systems andmethods of the present invention are not necessarily limited to use withrespect to such correctional facilities. For example, embodiments of thepresent invention may likewise be utilized with respect to any number ofother environments, such as hospitals, nursing homes, camps,dormitories, businesses, residences, kiosks, etcetera.

Telephone terminals 110-113 may not only comprise telephone handsets butmay also include general-purpose processor-based devices such aspersonal computers (PCs), personal digital assistants (PDAs), kiosks, orthe like. Terminals 110-113 are preferably connected to processor-basedcall processing system 120 by wire lines or wireless links, broadlydesignated 140. Processor-based call processing system 120 may comprisea programmable computer having a central processing unit (whethergeneral purpose or application specific), memory, and appropriateinput/output interfaces, which are operable under an instruction setdefining operation as described herein. All or any portion of callprocessing system 120 may be disposed within a facility it serves, in anoutside central location, or the processes shown provided byprocessor-based call processing system 120 may be provided in adecentralized manner by distributed processing outside and/or inside thefacility. Communications links 140 may comprise analog voice lines, suchas those associated with plain old telephone service (POTS), digitalcommunication links such as those used between a digital private branchexchange (PBX) and its associated user stations, and/or Ethernet orwireless communications links (e.g. for VoIP communication whereterminals 110-113 are multimedia terminals, VoIP phones, or the like),as examples. Line interface 123 provides interfacing between the signalsnative to terminals 110-113 and a processor or processors of callprocessing system 120.

VoIP gateway 126 may provide voice connectivity via WAN 180. WAN 180 maycomprise any data network, such as an intranet, an extranet, theInternet, a public network, a private network, and/or the like. Althoughillustrated as a WAN, it should be appreciated that embodiments of thepresent invention may utilize data networks such as a local area network(LAN), a metropolitan area network (MAN), an intranet, an extra net, theInternet, and/or the like, in combination with, or in the alternativeto, a WAN.

Terminals 110-113 may be placed in voice communication with any of anumber of user terminals via VoIP gateway 126 and WAN 180. For example,telephone terminal 155 connected to PSTN 160 may be placed incommunication with telephone terminal 110, via VoIP gateway 126 and WAN180, perhaps using a corresponding VoIP gateway, such as may be disposedat an edge of WAN 180 and coupled to PSTN 160, or otherwise associatedwith WAN 180 and/or PSTN 160. Additionally or alternatively, terminals110-113 may be placed in communication with devices such as videophones, multi-media computers, cellular phones, personal digitalassistants (PDAs), and/or the like via VoIP gateway 126 and WAN 180,whether such devices are coupled to WAN 180 or PSTN 160.

VoIP gateway 126 includes compressor and packetizer 125 and networkinterface 127. Compressor and packetizer 125 produces compressed datapackets from the telephony signals. These packets are processed innetwork interface 127 so that they can be applied through WAN 180 tocorresponding VoIP gateway. The telephone signals may be decompressedand depacketized by VoIP gateway and distributed to a public switch ofPSTN 160. VoIP gateway 126 may also decompress and depacketize incomingVoIP data packets to provide telephony signals to terminals 110-113,particularly where terminals 110-113 are not capable of decompressionand depacketization.

In operation according to embodiments of the present invention,terminals 110-113 are selectively connected to offsite PSTN 160 via WAN180 and VoIP gateway 126. Processor-based system 120 preferablyselectively connects appropriate ones of terminals 110-113 with the VoIPgateway 126 for completion of desired calls. VoIP gateway 126 utilizesinternet protocols to establish a packet-switched network connection (incontrast to a circuit-switched network connection of the PSTN) between acalling and called party to thereby connect a desired call.

VoIP gateway 126 of a preferred embodiment is provided to service andcontrol VoIP communications. Various types of VoIP communications may beeffectively managed and controlled in accordance with embodiments of thepresent invention by VoIP gateway 126. Voice data may be processed bymeans of a vocoder (Voice Coder/Decoder), as may be provided in VoIPgateway 126. Voice coding and decoding as utilized according toembodiments of the invention may implement one or more of severalstandard schemes, such as ITU recommendation G.723.1, G.729, or G.711among others.

The illustrated embodiment of FIG. 1 includes functionality of a callprocessing platform integrated with that of a call processing gateway.Of course, in other embodiments, such functionality may be separated. Inthe exemplary embodiment of FIG. 1, call processing system 120 is shownincluding switching control block 121, routing control block 122,billing control block 124, validation control block 128, andunauthorized call activity detection control block 129 in addition toline interface 123 and VoIP gateway 126. Typically,controlled-environment facilities, such as is described in the presentexample, have rules and regulations regarding telephone usage byresidents. Accordingly, switching control block 121, routing controlblock 122, billing control block 124, validation control block 128, andunauthorized call activity detection control block 129 may be utilizedto cooperatively control, route, connect, disconnect, and account forcalls. Unauthorized call activity detection control block 129 may takethe form of an agent program or the like. The functions represented byeach of switching control block 121, routing control block 122, billingcontrol block 124, validation control block 128, and unauthorized callactivity detection control block 129 may be implemented by equipmentdisposed within a facility served, in an outside central location, orthe processes may be provided in a decentralized manner by distributedprocessing outside and/or inside the facility.

A user of one of telephones 110-113 may place the telephone in anoff-hook condition and dial or otherwise provide user and/or accountidentification information, in addition to providing a destinationnumber or other information with respect to a desired call to be placed.Validation control block 128, perhaps in cooperation with a callapplication management system and/or a call treatment system, mayoperate to verify a) the identity of the calling party, b) that thecalling party is authorized to place a call, and c) that the calledparty will receive calls or is authorized to receive calls from thecalling party.

Unauthorized call activity detection control block 129 is preferablyoperable to monitor a connected call to provide call intelligence foruse in determinations with respect to allowing a particular call to becontinued and/or other call control features to be invoked. According toembodiments of the present invention, unauthorized call activitydetection control block 129, such as the aforementioned agent, providesreal-time intelligence with respect to fraudulent or otherwiseunauthorized activity being attempted during a call, such asunauthorized three-way call detection, as discussed in greater detailbelow.

It should be appreciated that call processing functionality may beprovided in a call flow at one or more points based upon variousconsiderations. For example, VoIP gateway 126 and/or unauthorized calldetection functionality 129 may be disposed in a number ofconfigurations and/or locations, such as disclosed in above incorporatedU.S. patent application Ser. No. 10/800,473, entitled “CALL PROCESSINGWITH VOICE OVER INTERNET PROTOCOL TRANSMISSION.” The illustratedembodiment shows unauthorized call activity detection control block 129coupled to line interface 123, disposed in the call flow external to theVoIP data stream, to operate with respect to telephony signals whichhave been decompressed and depacketized by VoIP gateway 126. However, asdiscussed in greater detail below, embodiments of the present inventionmay gather information from the VoIP data stream to provide at least oneaspect of three-way call detection. Thus, embodiments of the presentinvention may dispose various aspects of call processing functionality,particularly unauthorized call activity detection control block 129, ina call flow differently, whether inside or outside of the VoIP datastream, than as shown in FIG. 1.

FIGS. 2 and 3 are flowcharts of embodiments of methods employed inaccordance with the present invention for unauthorized call activitydetection, such as three-way call detection and/or prevention, in a VoIPenvironment. A first exemplary operational flow 200 according to oneembodiment is illustrated in FIG. 2, which may be used for three-waycall detection and/or prevention for a call between a conventional PSTNconnected caller, such as a PSTN-based connection provided to a personoutside of a controlled-environment facility, and a VoIP caller, such asa SIP-based connection provided to a user of phone 110 of call system100 of FIG. 1. The PSTN-based call is joining a VoIP-based call at agateway, such as gateway 126 of FIG. 1.

At 201 a resident of a controlled-environment facility picks up a phone,such as one of phones 110-113 of controlled phone system 100 illustratedin FIG. 1, to place a call. The resident then typically enters apersonal identification number or the like at 202. At 203 the residentthen enters a number outside the facility that he or she wishes to call.At 204 call processing and/or facility management functionality, such asdescribed above, determines if the resident is allowed to make callsand/or call the entered outside telephone number and connects the call,if allowed. In this example, a VoIP call may be established for theresident using SIP and interconnected via a PSTN to the outside numberusing conventional PSTN switching equipment, such as a terminatingswitch, typically employing out-of-band SS7 or PRI digital signaling.Then the call is connected to the called party off the terminatingswitch.

Data concerning the resident, such as may be maintained by acontrolled-environment facility call management system, acontrolled-environment facility information management system, or thelike, and/or data related to a called party or number may be used at204, to determine if there is a propensity for a three-way callsituation to arise in a particular call Some of the variables that couldbe considered at 204 might include past attempts to initiate a three-waycall or other unauthorized call activity; past attempts at other typesof fraud; the resident's payment status, billing activity, paymenthistory, calling activity, calling history; the nature of the facilitythe resident is calling from (e.g. the average length of stay in thefacility); and/or the like. As a result of a determination at 204 thatan elevated propensity for a three-way calling situation exists for aparticular call, various steps may be taken. For example, if it isdetermined at 204 that the resident or called party has participated incalls in the past in which an attempt to invoke a three-way call wasdetected, a sensitivity of three-way call detection may be elevated at204.

At 204 a determination may also be made that a three-way call or othercall features are allowed for a particular call. For example, if thecalled party is an attorney or bail bondsman, three-way calling may beallowed in order for the called attorney or bail bondsman to“conference-in” needed parties (e.g. a witness, surety, etc.)

Otherwise, when the PSTN call goes off hook to initiate a three-way callor the like, there are different types of out-of-band signaling comingfrom an SS7 environment of the PSTN-based call indicating a suspendevent reaches the gateway and then is translated to out-of-bandsignaling in a SIP environment. In the example of FIG. 2 the outsideparty on a PSTN line attempts to undertake unauthorized call activity,such as activate a traditional form of three-way calling at 205. At 206,various out-of-band and/or in-band signaling are detected that mayindicate a suspend event and/or a resume event indicating that a partyhas returned to the call.

By way or example, use of in-band signals for three-way call detectionmight include monitoring return of VAD idle noise at 207 as theequivalent of silence. For example, at 207 one embodiment of the presentinvention may treat the period where VAD idle noise being received as atime frame of silence period for detection of an attempt to initiate athree-way call. VAD typically will cut a call in and out rather quicklyto conserve bandwidth. Thus, the present systems and methods forunauthorized call activity detection may look for longer periods of VADactivity, such as would be generated by a VoIP gateway as a result of aparty hook flashing off of a call, which would result in the VoIPgateway only receiving silence from the PSTN connected caller.Embodiments of the present invention may, as mentioned, treat the VAD assilence for purposes of unauthorized call activity detection, whichmight also look for timing windows of such silence periods indicative ofestablishing a three-way call. In certain embodiments, such in-band VADdetection of idle noise may be compared against a simulated model of anapproximate description of the interaction between sources and theunderlying network. The interaction of a source with the rest of thesystem may be derived through an iterative procedure that evaluatesfeedback that a source receives from the network, for example.

An example of out-of-band signaling that may be used to detect three-waycalling activity may include monitoring of SS7 PSTN signaling thatindicates the outside party has done something, such as a flashhook(208), to initiate a three-way call. Within the PSTN environment,initiating a three-way or answering a call waiting call, such as by useof a flash hook, may generate an SS7 suspend event within the network.The generated SS7 suspend message is an indication to the opposite endof the call, in this case the calling system associated with theresident of the controlled-environment facility that the other end pointin the call, the outside party, is going to stop sending information. Ata later point in time when the hook flash happens a second time toeither come back on the call with another party or to resume this callfrom a call waiting event, there will be a resume event that is sent.When the VoIP gateway receives these events, it will transfer thoseevents into the SIP network.

As another example, in certain embodiments a three-way call attempt maybe deduced from a model of unacceptable packet loss which persists froma predetermined time period. For example, the packet loss for amonitored call may be compared against a simulated model of anapproximate description of the interaction between sources and theunderlying network. The interaction of a source with the rest of thesystem may be derived through an iterative procedure that evaluatesfeedback that a source receives from the network.

The method of transfer into the SIP network varies depending on thegateway. For example, a Generic Description Table (GDT) might be used totranslate the SS7 signaling into a SIP message, which may take the formof ASCII text. Another method of transfer of the suspend and resumeevent into the SIP network might employ a variation on the SIP protocolknown as SIP Trunking (SIP-T), which is adapted to carry SS7 networkinformation over the SIP network such that the information may beconverted back into SS7 information. A third method used to transfer asuspend and resume event into an SIP network might be termed a directcorrelation. The SIP protocol carries the call setup information, butthe protocol that carries the voice information is RTP. Within the RTPinformation there is a new signaling sent out that indicates that a newset of RTP information that describes the voice content is beingreceived. A suspend event may be identified within the RTP informationwhich might take the form of an indication that the target data is beingsent to is no longer present. This may result in an SIP message that aterminal is going into a receive only mode and no longer transmittingdata. A resume event may take the form of an RTP message that resumesthe entire connection.

In accordance with an embodiment of the present invention, a callinvolving a resident may be monitored to listen to all of the voicesengaged in the call. Thus, additionally or alternatively, at 225 theexemplary embodiment may also monitor the call established at 204 forcadence, frequency, and/or other attributes that occur in speech, andcapture data related thereto at 226. At 227 the captured data may beanalyzed to determine the number of voices taking part in a call. Usinginformation gathered from the voices such as frequencies, cadence,amplitude and other variables that might occur, detection capabilitiesthat are able to recognize the difference between foreground andbackground voices may be used at 227 to determine the number of partiesthat are engaged in the call. For example, systems employing anembodiment of the present invention might have certain voicecharacteristics data for the resident and voice characteristics data forthe outside called party might have been previously gathered duringearlier calls or at the beginning of the current call. This data may beused to make a determination at 227 that a third party, who's voicecharacteristics data does not match the resident or called party hasjoined the call. If at 227 it is determined that an additional set ofunique voice variables has joined a call, via a prohibited three-waycall or by other means, appropriate action may be taken at 210, asdiscussed in greater detail below.

In identifying the number of parties on a call it may be helpful todifferentiate the call legs and what call leg a voice appears on. Forexample, a call from a resident of a prison or similar facility maycontain many echo voices, due to the physical properties of the facilityand the proximity of other individuals. Therefore, at 225-227 it may bemore advantageous to monitor the leg of the call coming from the calledparty to the resident for an additional voice or voices.

Monitoring a call at 225-227 may also, or alternatively, includemonitoring to identify other sounds of interest, such as a gunshots, ascream, people in very panicked states or any other things that might beof interest to an investigator. An investigator may be alerted at 214 asa result of the detection of such a sound of interest or the callflagged for investigation at 211, as discussed in greater detail below.

Upon detection of an attempt to initiate a three-way call at 206, ordetection of a new voice or sound of interest at 225-227, appropriateaction may be taken by calling systems employing an embodiment of thepresent invention at 210. Such appropriate action might include flaggingthe call for investigation at 211, intervening at 212 to warn theparties to not participate in a three-way call, disconnecting the callat 213, monitoring the call for investigative purposes at 214, alertingauthorities at 215, and/or the like. Alternatively or additionally, ifit is determined at 204 that a call has a heightened propensity for athree-way call situation to arise, the response applied at 210 upondetection of an attempt to initiate a three-way call at 206, may beelevated. For example, if a three-way call attempt would normally onlybe logged or otherwise noted for possible further investigation at 211,the call parties may be warned (212), and in a situation where the callparties might normally only be warned at 212, a call may be disconnected(213) when an attempt to initiate a three-way call is detected.

Another method embodiment, 300, is illustrated in FIG. 3 for three-waycall detection and/or prevention in a call where both call parties areemploying VoIP. At 301 a resident of a controlled-environment facilitypicks up a phone, such as a phone of a controlled phone system, to placea call. The resident then typically enters a personal identificationnumber or the like at 302 and at 303 the resident enters a number,outside the facility, that he or she wishes to call. At 304 callprocessing and/or facility management functionality determines if theresident is allowed to make calls and/or call the entered outsidetelephone number and connects the call, if allowed. In this example, aVoIP call may be established for the resident using SIP andinterconnected via the system VoIP gateway and a PSTN, which may alsoemploy a VoIP gateway or the like to complete the call.

Similar to as discussed above concerning step 204 of FIG. 2, dataconcerning the resident, such as may be maintained by acontrolled-environment facility call management system, acontrolled-environment facility information management system, or thelike, and/or data related to a called party or number may be used at304, to determine if there is a propensity for a three-way callsituation to arise in a particular call. As a result of a determinationat 304 that an elevated propensity for a three-way calling situationexists for a particular call, various steps may be taken. For example,sensitivity of three-way call detection may be elevated at 304.

At 304 a determination may also be made that a three-way call or othercall features are allowed for a particular call. For example, if thecalled party is an attorney or bail bondsman, three-way calling may beallowed in order for the called attorney or bail bondsman to“conference-in” needed parties (e.g. a witness, surety, etc.)

At 305 in the illustrated example of FIG. 3, the called, outside partyattempts to activate three-way calling. In a VoIP-to-VoIP call where thetransmission is being handled between end points or call agents within aVoIP network changes in the routing of a call are typically noted insignaling that occurs out-of-band from the voice, in SIP or otherprotocol handling the set-up and routing of the call. Once a VoIP toVoIP call is established, any routing change request, such as wouldoccur when a three-way call is initiated, results in SIP updates, or thelike, being sent to effect such routing changes. At 306 digitalsignaling, such as SIP signaling, that occurs between traditional VoIPdevices may be monitored to determine when one VoIP device attempts toinvite a third party or another gateway to join into the existing VoIPcall.

In-band unauthorized call activity detection may also be employed inaccordance with certain embodiments of the present invention forVoIP-to-VoIP calls. The RTP stream, or the like that is transmitted asvoice data might include a sequence numbers commonly referred to asinternal session identifiers or internal sequence numbers, per InternetRFC specifications. Whenever a remote gateway reinitiates some elementof a data stream, even though it may not have changed terminatinginformation, the gateway may change internal session identifiers orinternal sequence numbers per RFC specifications. Thus, if at 306 adetermination is made that internal session identifiers, internalsequence numbers, or the like of a voice data stream has changed in amanner consistent with initiation of unauthorized call activity, such asa three-way call, it may be determined that unauthorized call activityis taking place. For example a jump in sequence numbers that does notcorrelate in time, or a change in session IDs, can be used in accordancewith an embodiment of the present invention as an indication that aremote point in a VoIP-to-VoIP call has substantially changed thecontent of the stream.

Alternatively, in a VoIP-only environment, such as employed in theexemplary operational flow 300 of one embodiment, unauthorized callactivity, such as the addition of third parties to a call, may bedisallowed (320) at the time the call is established, such as at 304, tocompletely block, and possibly avoid the need to detect, attempts toinitiate three-way calling. The disallowance at 320 may be accomplishedby setting call features enabled for the VoIP call parties to notinclude unauthorized call features, such as three-way calling.

Similar to as discussed above concerning steps 225-227 of FIG. 2, a callinvolving a resident may be monitored to listen to all of the voicesengaged in the call. At 325, call processing system 120 of the exemplaryembodiment may monitor the call established at 304 for cadence,frequency, and/or other attributes that occur in speech. Monitoring acall at 325 may also, or alternatively, include monitoring to identifyother sounds of interest, such as a gunshots, a scream, etcetera. At326, data associated with the voices or sounds may be captured. At 327,the captured data may be analyzed to determine the number of voicestaking part in a call. If at 327 it is determined that an additional setof unique voice variables has joined a call, via a prohibited three-waycall or by other means, or that a sound of interest has occurred duringthe call appropriate action may be taken at 310.

At 310, the call processing system 120 employing an embodiment of thepresent invention may take appropriate action in response to detectionof an attempt to initiate a three-way call at 306, such as flagging thecall for investigation at 311, intervening at 312 to warn the parties tonot participate in a three-way call, disconnecting the call at 313,monitoring the call for investigative purposes at 314, alertingauthorities at 315, and/or the like. Alternatively or additionally, ifit is determined at 304 that a call has a heightened propensity for athree-way call situation to arise, the response applied at 310, upondetection of an attempt to initiate a three-way call at 306, may beelevated. For example, if a three-way call attempt would normally onlybe logged or otherwise noted for possible further investigation at 311,the call parties may be warned (312), and in a situation where the callparties might normally only be warned at 312, a call may be disconnected(313) when an attempt to initiate a three-way call is detected.

Although the present invention and its advantages have been described indetail, it should be understood that various changes, substitutions andalterations can be made herein without departing from the spirit andscope of the invention as defined by the appended claims. Moreover, thescope of the present application is not intended to be limited to theparticular embodiments of the process, machine, manufacture, compositionof matter, means, methods and steps described in the specification. Asone of ordinary skill in the art will readily appreciate from thedisclosure of the present invention, processes, machines, manufacture,compositions of matter, means, methods, or steps, presently existing orlater to be developed that perform substantially the same function orachieve substantially the same result as the corresponding embodimentsdescribed herein may be utilized according to the present invention.Accordingly, the appended claims are intended to include within theirscope such processes, machines, manufacture, compositions of matter,means, methods, or steps.

1. A method for providing call processing in a prison facility,comprising: receiving a request to place a call from a terminal accessedby a calling party in the prison facility; connecting the call to acalled party outside the controlled-environment facility via a Voiceover Internet Protocol (VoIP) gateway between the terminal and a phonenetwork; and detecting three-way call activity in the call by monitoringVoIP signals transmitted between the VoIP gateway and the terminal.